refactor(wasm-gen, runtime-fuzzer): Increase successful messages exec…

…ution rate in `runtime-fuzzer`. (#3383)
gear-tech · Oct 2, 2023 · a4763d8 · a4763d8
1 parent 1feb3d2
commit a4763d8
Show file tree

Hide file tree

Showing 5 changed files with 27 additions and 19 deletions.
diff --git a/scripts/src/test.sh b/scripts/src/test.sh
@@ -88,7 +88,7 @@ run_fuzzer() {
   cd $ROOT_DIR/utils/runtime-fuzzer
 
   if [ "$3" = "wlogs" ]; then
-    LOG_TARGETS="debug,syscalls,gear_wasm_gen=trace,runtime_fuzzer=trace,gear_backend_common=trace"
+    LOG_TARGETS="debug,syscalls,gear_wasm_gen=trace,runtime_fuzzer=trace,gear_core_backend=trace"
   else
     LOG_TARGETS="off"
   fi

diff --git a/utils/node-loader/src/utils.rs b/utils/node-loader/src/utils.rs
@@ -219,18 +219,18 @@ pub fn get_wasm_gen_config(
             (SysCallName::Leave, 0..=0),
             (SysCallName::Panic, 0..=0),
             (SysCallName::OomPanic, 0..=0),
-            (SysCallName::Send, 20..=30),
+            (SysCallName::Send, 10..=15),
             (SysCallName::Exit, 0..=1),
-            (SysCallName::Alloc, 5..=10),
-            (SysCallName::Free, 5..=10),
+            (SysCallName::Alloc, 3..=6),
+            (SysCallName::Free, 3..=6),
         ]
         .map(|(sys_call, range)| (InvocableSysCall::Loose(sys_call), range))
         .into_iter(),
     );
 
     let mut params_config = SysCallsParamsConfig::default();
     params_config.add_rule(ParamType::Alloc, (1..=10).into());
-    params_config.add_rule(ParamType::Free, (initial_pages..=initial_pages + 25).into());
+    params_config.add_rule(ParamType::Free, (initial_pages..=initial_pages + 50).into());
 
     StandardGearWasmConfigsBundle {
         log_info: Some(format!("Gear program seed = '{seed}'")),

diff --git a/utils/runtime-fuzzer/README.md b/utils/runtime-fuzzer/README.md
@@ -23,7 +23,7 @@ dd if=/dev/urandom of=fuzz/corpus/main/fuzzer-seed-corpus bs=1 count=27000000
 
 # Run fuzzer for at least 20 minutes and then press Ctrl-C to stop fuzzing.
 # You can also remove RUST_LOG to avoid printing tons of logs on terminal.
-RUST_LOG=debug,syscalls,gear_wasm_gen=trace,runtime_fuzzer=trace,gear_backend_common=trace \
+RUST_LOG=debug,syscalls,gear_wasm_gen=trace,runtime_fuzzer=trace,gear_core_backend=trace \
 cargo fuzz run \
     --release \
     --sanitizer=none \

diff --git a/utils/runtime-fuzzer/src/gear_calls.rs b/utils/runtime-fuzzer/src/gear_calls.rs
@@ -43,6 +43,14 @@ use gear_wasm_gen::{
 const MAX_PAYLOAD_SIZE: usize = 512 * 1024;
 static_assertions::const_assert!(MAX_PAYLOAD_SIZE <= gear_core::message::MAX_PAYLOAD_SIZE);
 
+/// Maximum salt size for the fuzzer - 512 bytes.
+///
+/// There's no need in large salts as we have only 35 extrinsics
+/// for one run. Also small salt will make overall size of the
+/// corpus smaller.
+const MAX_SALT_SIZE: usize = 512;
+static_assertions::const_assert!(MAX_SALT_SIZE <= gear_core::message::MAX_PAYLOAD_SIZE);
+
 /// This trait provides ability for [`ExtrinsicGenerator`]s to fetch messages
 /// from mailbox, for example [`UploadProgramGenerator`] and
 /// [`ClaimValueGenerator`] use it.
@@ -238,8 +246,11 @@ impl UploadProgramGenerator {
     }
 
     const fn unstructured_size_hint(&self) -> usize {
-        // 1024 KiB for payload and salt and 50 KiB for code.
-        1080 * 1024
+        // Max code size - 50 KiB.
+        const MAX_CODE_SIZE: usize = 50 * 1024;
+        const AUXILIARY_SIZE: usize = 512;
+
+        MAX_CODE_SIZE + MAX_PAYLOAD_SIZE + MAX_SALT_SIZE + AUXILIARY_SIZE
     }
 }
 
@@ -377,7 +388,7 @@ fn arbitrary_message_id_from_mailbox(
 }
 
 fn arbitrary_salt(u: &mut Unstructured) -> Result<Vec<u8>> {
-    arbitrary_limited_bytes(u, MAX_PAYLOAD_SIZE)
+    arbitrary_limited_bytes(u, MAX_SALT_SIZE)
 }
 
 fn arbitrary_payload(u: &mut Unstructured) -> Result<Vec<u8>> {
@@ -400,21 +411,18 @@ fn config(
             (SysCallName::Leave, 0..=0),
             (SysCallName::Panic, 0..=0),
             (SysCallName::OomPanic, 0..=0),
-            (SysCallName::Send, 20..=30),
+            (SysCallName::Send, 10..=15),
             (SysCallName::Exit, 0..=1),
-            (SysCallName::Alloc, 20..=30),
-            (SysCallName::Free, 20..=30),
+            (SysCallName::Alloc, 3..=6),
+            (SysCallName::Free, 3..=6),
         ]
         .map(|(sys_call, range)| (InvocableSysCall::Loose(sys_call), range))
         .into_iter(),
     );
 
     let mut params_config = SysCallsParamsConfig::default();
     params_config.add_rule(ParamType::Alloc, (10..=20).into());
-    params_config.add_rule(
-        ParamType::Free,
-        (initial_pages..=initial_pages + 250).into(),
-    );
+    params_config.add_rule(ParamType::Free, (initial_pages..=initial_pages + 35).into());
 
     let existing_addresses = NonEmpty::collect(
         programs

diff --git a/utils/wasm-gen/src/config/module.rs b/utils/wasm-gen/src/config/module.rs
@@ -368,9 +368,9 @@ impl Default for SelectableParams {
             allowed_instructions: vec![
                 Numeric, Reference, Parametric, Variable, Table, Memory, Control,
             ],
-            max_instructions: 100_000,
-            min_funcs: 15,
-            max_funcs: 30,
+            max_instructions: 500,
+            min_funcs: 3,
+            max_funcs: 5,
             unreachable_enabled: true,
         }
     }